H-REAP will not work in your situation because you can't control the remote end router. If you look at the H-REAP deployment guide there is a section regarding H-REAP behind a Nat'd device, but again... that will not work in your environment. Like Leo mentioned, Office Extend is your only choice.... VPN is your cheaper way for emplyees connectivity back to HQ in my opinion.